In this paper, we present an access control model for spatial data on Web. Such a model is based on the following assumptions: first, spatial data consist of objects with sharp boundaries located in a geographical space; second, data are manipulated through the operations provided by a Web Map Management Service. The goal of the system is to control the way data are accessed by users having different profiles. We propose an extension of classical models based on authorization rules by assigning authorizations a geographical scope. In such a way, the operations users may execute on spatial data may vary, depending on user identity and object position.